Web3Auth Moves At-Risk Assets Into Recovery Wallets

By Tom Whitfield

On Nov. 7, Web3Auth disclosed that unauthorized access affected some accounts created through Google or Apple sign-in, prompting the company to move some at-risk assets into recovery wallets.

Working with Keplr, Web3Auth transferred some of the at-risk assets and published verified addresses across multiple blockchain networks. The disclosure did not state the number of affected accounts, the value of the assets or a complete list of affected holdings.

What exactly did Web3Auth disclose?

Web3Auth described the issue as affecting “part of the embedded-wallet service used in third-party apps,” including Torus Wallet and Keplr. The company limited its update to some accounts and some assets, rather than declaring every account or asset affected.

That scope leaves users without a complete list of accounts requiring review, holdings eligible for recovery or a stated ownership-verification procedure. The disclosure does not provide a technical account of how the unauthorized access occurred or identify an affected holding.

Google and Apple appear in the disclosure only in relation to account creation, not as parties blamed for the unauthorized access. Web3Auth attributed the problem to a security issue in its own infrastructure and did not identify an attacker.

Web3Auth also did not name any specific chain or token standard, or disclose a dollar value. Its narrower description of some accounts and some assets limits any conclusion about a broader compromise of Google or Apple sign-in accounts.

How are the recovery wallets being used?

Web3Auth and Keplr moved some of the at-risk assets into recovery wallets and published verified addresses for those wallets across multiple blockchain networks. The addresses identify recovery destinations while the assets remain in those wallets, rather than being distributed immediately to users.

Publishing the addresses gives users and counterparties a shared reference for identifying where the selected assets sit during recovery. The disclosure does not describe eligibility checks, claim forms, fees or a distribution schedule.

The separation between address publication and asset return leaves two distinct stages. Web3Auth has identified destinations for the selected assets, while Web3Auth and Keplr continue coordinating their return to users.

Why do Keplr and Torus Wallet matter?

The affected embedded-wallet infrastructure supports Torus Wallet, Keplr and other third-party applications, extending the operational issue beyond a single app interface. For integrators using Web3Auth, the incident creates a need to distinguish affected sign-in accounts from unaffected ones and explain the recovery path to customers.

The response therefore depends on Web3Auth and Keplr coordinating the return of assets to affected users. Web3Auth expects more details on that return process in the coming days.

The disclosure does not quantify losses or establish the total value exposed. Web3Auth described the transferred holdings as at risk, leaving the final financial exposure undetermined while the companies work through the recovery process.

What will determine the recovery timeline?

The next update must address the account list, the recovery method and the timing for returning funds, because the Nov. 7 disclosure supplied recovery addresses but no firm distribution deadline. Keplr's coordination role remains central because its wallet product counted among the affected third-party services.

The absence of a disclosed account count, asset value or network list also limits any assessment of the incident's scale. The update expected in the coming days should supply the missing recovery procedure and distribution timetable, because published addresses alone do not return assets to users.